Voicera AI, Inc. Privacy Policy

This Privacy Policy describes how Voicera AI, Inc. ("Voicera," "we," "us," or "our") collects, uses, discloses, and protects information when you access the Voicera web application, REST API, or related services (the "Service"). It is incorporated by reference into our Terms of Use.

By using the Service, you consent to the practices described in this Policy. If you do not agree, do not use the Service.

1. Definitions

"Personal Data" means any information that identifies or could reasonably identify an individual, as defined under applicable law, including GDPR and CCPA/CPRA.

"Biometric Data" means voice prints, facial geometry, and other biometric identifiers or templates derived from your Submissions, which may constitute biometric information under Illinois BIPA, Texas CUBI, or other state law.

"Submission" means any audio or video file you upload to the Service for sincerity analysis.

"Analysis Output" means scores, transcripts, diarization data, per-segment analytics, and other processed results generated from your Submission.

"Usage Data" means data collected automatically about your interaction with the Service, including IP addresses, browser type, pages visited, session duration, and device identifiers.

"Service Provider" means a third-party company or individual that processes data on Voicera's behalf.

2. Information We Collect

2.1 Information You Provide

Account registration: name, email address, company (if applicable), and password.

API key requests and usage: API key credentials stored as SHA-256 hashes in DynamoDB (voicera-api-keys).

Submissions: audio and video files you upload for analysis. These are stored in Amazon S3 at the key pattern uploads/{customer_id}/{job_id}{ext}.

Communications: any information you provide when contacting support or legal.

2.2 Information Generated by the Service

Analysis Output is generated from your Submissions and stored in S3 (results/sincerity/, results/video/, results/composite/) and includes: sincerity scores, composite scores, WebVTT transcripts, plain-text transcripts, per-segment emotional and linguistic data, and facial geometry embeddings. Analysis Output is associated with your customer_id and job_id.

Job and session records are stored in DynamoDB tables (voicera-jobs, voicera-batches, voicera-sessions). An immutable audit log of composite fusion events is maintained in the voicera-audit table.

2.3 Usage Data

We automatically collect Usage Data when you access the Service, including: IP address, browser type and version, pages and endpoints accessed, timestamps, time spent, device identifiers, and operating system information. Usage Data is logged to AWS CloudWatch with a 30-day retention period.

2.4 Cookies and Tracking Technologies

We use the following cookies and similar technologies:

• Essential/Session Cookies: Required for authentication and fraud prevention.
• Cookie Acceptance Cookies (Persistent): Record your consent to cookie use.
• Functionality Cookies (Persistent): Remember your preferences (login, language).
• Analytics Cookies (Persistent, Third-Party): Used by Google Analytics to track Service usage. See Section 4.1.

You may disable cookies in your browser, though this may impair Service functionality.

2.5 Biometric Data

The Service processes voice recordings (including prosodic and spectral features) and facial geometry (MediaPipe landmarks, InsightFace ArcFace embeddings) from your Submissions. This data may constitute biometric information under applicable state law. Where required by law, Voicera will:

• Provide written notice of collection and purpose prior to collection;
• Obtain a written release;
• Not sell, lease, or profit from biometric data;
• Store, transmit, and protect biometric data using a reasonable standard of care; and
• Retain biometric data only for the period necessary to fulfill the stated purpose, and then permanently destroy it.

You represent that you have independently obtained all required consents from individuals whose biometric data is contained in your Submissions before uploading to the Service.

3. How We Use Your Information

Voicera uses Personal Data and other information for the following purposes:

• To provide and operate the Service, including processing Submissions, generating Analysis Output, and maintaining job records.
• To authenticate users and prevent unauthorized access via API key validation.
• To manage your Account and fulfill contractual obligations.
• To communicate with you about your Account, security updates, and Service changes.
• To send marketing communications, subject to your opt-out rights.
• To improve the Service through aggregated, de-identified analytics.
• To comply with legal obligations and enforce our Terms of Use.
• To detect and prevent fraud, security incidents, and abuse.
• In connection with a business transfer, merger, or acquisition (see Section 5.2).

We do not use your Submissions or Analysis Output to train or fine-tune ML models without your separate written consent.

4. Third-Party Service Providers and Disclosures

4.1 Infrastructure and Analytics

The Service runs entirely on Amazon Web Services (AWS) in the us-east-1 region. AWS services used include: ECS Fargate, S3, DynamoDB, SQS, EventBridge, ALB, Route53, CloudWatch, ECR, IAM, ACM, and Lambda. AWS Privacy information: https://aws.amazon.com/privacy/.

Google Analytics: We use Google Analytics to monitor Service usage. Google may use collected data for its own advertising purposes. You may opt out via the Google Analytics opt-out browser add-on: https://tools.google.com/dlpage/gaoptout.

HubSpot and Brevo: Used for email marketing. Privacy policies at https://hubspot.com and https://www.brevo.com respectively. You may unsubscribe from marketing emails at any time.

4.2 ML Model Providers

The Service downloads and uses the following pre-trained models from third-party providers: OpenAI Whisper-large (openai-whisper), HuggingFace models (SamLowe/roberta-base-go_emotions, distilbert-base-uncased-finetuned-sst-2-english, superb/wav2vec2-base-superb-er), InsightFace buffalo_sc (GitHub releases), and MediaPipe 0.10.9. These models process Submission data within Voicera's secure AWS environment.

4.3 Other Disclosures

Voicera may disclose Personal Data: (a) to comply with legal process, court orders, or governmental requests; (b) to protect and defend Voicera's rights or property; (c) to prevent fraud or illegal activity; (d) with your consent; or (e) to Affiliates, subject to this Policy.

Voicera does not sell Personal Data as that term is commonly understood. Certain sharing with Service Providers for analytics and marketing may constitute a "sale" or "share" under CCPA/CPRA. See Section 7 for your opt-out rights.

5. Data Retention and Deletion

5.1 Retention Periods

Submissions (audio/video files in S3): retained for the duration of your Account and a reasonable period thereafter unless you request deletion. Analysis Output (JSON, VTT, transcript in S3): same retention as Submissions. DynamoDB job and session records: retained as needed for service operation; session tokens carry a TTL. CloudWatch logs: 30-day retention. Audit table (voicera-audit): immutable; not subject to deletion requests. API keys: retained until Account termination or key revocation.

5.2 Business Transfers

If Voicera is involved in a merger, acquisition, or sale of assets, your Personal Data may be transferred. We will provide notice before your data is transferred to a different privacy policy.

5.3 Deletion Requests

You may request deletion of your Personal Data by contacting support@voicera.io or using the account settings page. We will honor deletion requests subject to legal obligations requiring retention. We will provide written confirmation of deletion or identify any applicable exceptions within 45 days.

6. Data Security

The Service employs the following security measures:

• VPC isolation: API and worker tasks run in private subnets (us-east-1a, us-east-1b) with no direct inbound access.
• TLS in transit: All traffic is encrypted via HTTPS (ALB with ACM certificate). API keys are transmitted only in headers.
• API key hashing: API keys are stored as SHA-256 hashes.
• IAM least-privilege: ECS tasks use dedicated IAM roles with scoped permissions.
• ECR scan on push: All container images are scanned for vulnerabilities on push.
• SQS message visibility and DLQ: Failed messages trigger CloudWatch alarms.

No method of transmission or storage is 100% secure. We cannot guarantee absolute security. You assume the risk of transmitting data to the Service.

7. Your Privacy Rights

7.1 All Users

You have the right to: access Personal Data we hold about you; correct inaccurate data; request deletion (subject to legal exceptions); and withdraw consent where processing is consent-based. To exercise these rights, contact support@voicera.io.

7.2 California Residents (CCPA/CPRA)

If you are a California resident, you have the following additional rights:

• Right to Know: Request disclosure of categories and specific pieces of Personal Data we have collected, the sources, business purposes, and third parties with whom we share it.
• Right to Delete: Request deletion of your Personal Data, subject to exceptions.
• Right to Correct: Request correction of inaccurate Personal Data.
• Right to Opt-Out of Sale/Sharing: We do not sell Personal Data in the traditional sense, but certain sharing with analytics and advertising providers may qualify. To opt out, contact us or use the "Do Not Sell My Personal Information" mechanism on our website.
• Right to Limit Use of Sensitive Personal Information: You may request we limit use of sensitive Personal Data (including account credentials and biometric data) to purposes necessary to provide the Service.
• Right Not to Be Discriminated Against: We will not discriminate against you for exercising CCPA/CPRA rights.

CCPA Categories of Personal Data Collected in the Last 12 Months:

• Category A (Identifiers): Yes — name, email, IP address, API key identifiers.
• Category B (California Customer Records): Yes — name, email.
• Category E (Biometric): Yes — voice and facial geometry data from Submissions (see Section 2.5).
• Category F (Internet Activity): Yes — usage logs, CloudWatch data.
• Category H (Sensory/Audio/Visual): Yes — audio and video Submissions.
• Category L (Sensitive Personal Information): Yes — account credentials, biometric data.
• All other CCPA categories: No.

To exercise CCPA/CPRA rights, contact us at support@voicera.io or https://voicera.io/contact-us/. We will verify your identity before responding. Responses provided within 45 days; extendable by 45 days with notice. Requests are free of charge.

7.3 EU/EEA Residents (GDPR)

If you are located in the EU/EEA, we process your Personal Data under the following legal bases: (a) contract performance (providing the Service); (b) consent (marketing communications, cookies); (c) legal obligation; and (d) legitimate interests (security, fraud prevention, service improvement).

You have the right to: access your data (Art. 15); rectify inaccurate data (Art. 16); erasure (Art. 17); restrict processing (Art. 18); data portability (Art. 20); object to processing (Art. 21); and lodge a complaint with your local supervisory authority.

To exercise GDPR rights, contact support@voicera.io. We respond within 30 days.

Cross-border transfers: Data is processed on AWS us-east-1 (United States). Transfers from the EEA are subject to appropriate safeguards, including Standard Contractual Clauses where applicable.

8. Children's Privacy

The Service is not directed at individuals under 18. We do not knowingly collect Personal Data from minors. If you believe we have inadvertently collected data from a minor, contact support@voicera.io and we will promptly delete it.

9. Interview Live (Real-Time WebSocket)

When using the optional Interview Live WebSocket endpoint (/ws/live) in default acoustic-only mode (ACOUSTIC_ONLY=true), audio chunks are processed transiently in memory. No DynamoDB job record is created and no result is written to S3 for each chunk by default. If operated in full-pipeline mode (ACOUSTIC_ONLY=false), the data handling is the same as for standard audio analysis jobs. Customer-side logging configurations for Interview Live are the customer's responsibility.

10. Do Not Track

The Service does not respond to browser Do Not Track signals. You may opt out of Google Analytics as described in Section 4.1.

11. California Shine the Light

California residents with an established business relationship may request, once per year, information about Personal Data shared with third parties for their direct marketing purposes. Contact us at support@voicera.io.

12. Changes to This Policy

We may update this Policy periodically. We will notify you of material changes via email or a prominent notice on the Service prior to the change taking effect, and will update the Last Updated date above. Your continued use of the Service after the effective date constitutes acceptance of the updated Policy.

13. Contact

For privacy inquiries, requests, or complaints:

Voicera AI, Inc. | 1920 Hillhurst, Los Angeles, CA 90027 | support@voicera.io | https://voicera.io/contact-us/

Copyright © 2026 Voicera AI, Inc. | Updated June 5, 2026